|Publication number||US7475398 B2|
|Application number||US 09/920,995|
|Publication date||Jan 6, 2009|
|Filing date||Aug 1, 2001|
|Priority date||Aug 1, 2000|
|Also published as||US20020108028|
|Publication number||09920995, 920995, US 7475398 B2, US 7475398B2, US-B2-7475398, US7475398 B2, US7475398B2|
|Original Assignee||Wind River Systems, Inc.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (9), Referenced by (15), Classifications (22), Legal Events (4)|
|External Links: USPTO, USPTO Assignment, Espacenet|
Computing systems generally use an operating system to provide system resource management for various software applications that may execute in the computing system. The operating system itself typically employs a kernel and a set of libraries and/or utilities. The kernel includes the most basic (and necessary) operating system functions and data structures (such as a task scheduler and I/O functions), while the libraries/utilities may include other functionality which is useful to applications (such as a network stack). In computing systems employing a flat, protectionless memory model, applications may access the operating system functions and data structures by linking to the memory locations associated with the desired function/data structure and directly accessing the memory locations associated with the desired function/data structure at run time.
In order to protect the integrity of the operating system during the execution of application software—for example, during debugging—operating systems may employ a memory protection scheme that shields critical operating system-related memory areas from access. For example, memory space for kernel functions and data structures may be logically isolated from memory space in which application functions and data structures are stored. Memory access to kernel memory space may be further restricted through the use of a Memory Management Unit (MMU) that restricts memory accesses to protected memory areas. In addition, some microprocessors provide for multiple “modes” of operation—for example, a “user” mode for the execution of applications and other non-trusted software, and a “supervisor” mode for the execution of kernel functions and other trusted software.
In order to allow applications to use kernel facilities in systems which use a memory protection scheme, special “system call” procedures have been implemented. For example, in some operating systems, all accesses to kernel memory space are performed indirectly via an interrupt request to specified interrupt numbers (using, for example, and “INT xx” processor instruction (sometimes called an “op code”), where the “xx” is the number of the interrupt), with parameters passed via specified registers or memory locations. The interrupt handler is used to invoke the desired kernel function, thus preventing the calling program from directly accessing the kernel. Another construct that has been used is an exception-based system call, which uses exceptions generated by a memory management unit (MMU) as a result of direct memory accesses to enforce the memory protection scheme. An advantage of the exception-based system call is that a special system call instruction is not needed, and therefore program code can invoke “system” functions and data (i.e., located in protected memory areas) in a fashion similar to that used to invoke “non-system” functions and data, as well as avoid the use of additional tasks to achieve such access.
The use of system calls in protected memory systems, however, introduces a significant amount of delay into system memory access. For example, the interrupt-based system call requires the generation of an interrupt, the execution of an interrupt handler to enable the system memory access, and perhaps the creation of a “system task” to perform the desired function/memory access. Even the exception-based system call requires the processing of the exception (although only when making an access to a protected memory region). Thus, in order to maximize execution speed, it is desirable to run applications using a protectionless memory system.
Developers have previously attempted to utilize memory protection schemes during application development. The protection scheme protects the operating system during the implementation phase and can be used to indicate programming errors (e.g., illegal modification of kernel data structures). Once the application has been tested and a degree of confidence in the application's trustworthiness has been determined, application designers remove the protection mechanisms, which heretofore required actually changing the program code to provide direct access to previously protected memory areas. Such changes not only were time-consuming, but introduced the possibility of introducing additional bugs into the application. Additionally, application developers have been limited to the single method of invoking system calls supported by the operating system, even where no protection was desired, or faster execution speed could be achieved using alternative system call techniques.
As one of the preferred embodiments according to the present invention, a method is provided, comprising the steps of determining a current processing mode of an executing software function, and when the current processing mode is a privileged processing mode, executing a direct program flow control instruction to directly access an instruction within software having the privileged processing mode. When the current processing mode is an unprivileged processing mode, executing an indirect program flow control instruction to cause execution of the instruction within software having the privileged processing mode.
As another of the preferred embodiments according to the present invention, a method is provided comprising the steps of identifying a program code segment implementing an access to a memory area to be executed within a privileged processing mode, and replacing the program code segment with a substitute code segment. The substitute code segment includes program code to identify a current processing mode of the program code segment, execute a direct program flow control instruction if the current processing mode is the privileged processing mode, and execute an indirect program flow control instruction if the current processing mode is an unprivileged processing mode.
Throughout the foregoing description, reference will be made to “modes” of protection related to the level of protection afforded functions executing in a computer system. For purposes of this description, an “unprivileged” mode is a mode of protection associated with the lower level of access rights to memory in the computing system. A “privileged” mode is a mode of protection associated with the higher level of access rights to memory in the computer system. Various computing systems use different descriptions for these terms and may include more than two protection levels. As will be clear from the discussion below, the implementations according to the present invention would encompass such equivalent descriptions.
According to the present invention, a “smart system call” may be implemented. The smart system call employs a code “stub” that is used by unprivileged applications to make function calls to privileged memory locations. The code stub includes facilities to determine the current mode of execution (e.g., privileged, unprivileged), and where the current mode is sufficiently trusted, allows a direct access to the desired memory address. If the current mode is not sufficiently trusted (e.g., unprivileged), an alternate indirect system call mechanism may be employed, such as an interrupt or exception based system call (which may cause the spawning of privileged mode tasks to execute the desired function). Additionally, the smart system call permits selection of a system call method based on processor type, which may be used, for example, for porting to processor architectures which support specialized system call instructions.
Preferred exemplary embodiments according to the present invention implement the smart system call in conjunction with the Pentium® III microprocessor (available from Intel Corporation, Santa Clara, Calif.). Alternatively, other microprocessors could be used. The Pentium® III microprocessor provides an on-chip MMU for processing memory accesses, as well as a “hardware-assisted” facility for performing memory access to protected memory—the “sysenter” op code and “sysexit” op code. As will be seen below, the exemplary embodiments are applicable to a variety of commercially available operating systems and microprocessors.
The operation of a first exemplary embodiment according to the present invention is illustrated by the flow chart of
An example of source code and machine code to implement the first example code stub is shown in the table below:
TABLE 1 Source Code Machine Code lte: movl % cs, % eax 0×8C, 0×C8 andl $0×3, % eax 0×83, 0×E0, 0×03 movl $lte, % eax 0×B8, 0×00, 0×00, 0×00, 0×00 movl 20(% eax), % edx 0×8B, 0×50, 0×14 jnz lteUser 0×75, 0×02 jmp *% edx 0×FF, 0×E2 lteUser: int 0×40 0×CD, 0×40 nop 0×90
In this example, the last 2 bits of the code segment register (“%cs,” provided by the Pentium® III processor) indicate the current protection mode of the executing task (for example, 0 for privileged mode, 3 for unprivileged mode). Other registers or memory locations could of course be used for the same purpose on other processors. According to the above code stub, if the current mode is not unprivileged (i.e., the last two bits of the code segment register are non-zero), a direct jump is made to the entry address of the desired function (provided in register “% edx”). If the current mode is unprivileged (i.e., the last two bits of the code segment register are zero), the system call is made using the interrupt based system call (in this example, “int 0x40”).
Note that this first example allows for easy implementation of direct access to protected memory in systems that employ interrupt-based system calls, thus offering the possibility of significant performance increases when operating both the operating system and application in privileged mode (which would otherwise not be available), and providing the flexibility to change protection modes dynamically (e.g., for debugging purposes). Further note that the exemplary code stub is implemented in a small package of twenty total bytes, and the quantity of bytes will not vary from function call to function call (which will allow for interchangeability, as discussed in further embodiments below).
The code stub of the exemplary embodiment shown above may be inserted, for example, during compilation and/or linking of application source code. As an example, as shown in
Another advantage realized from the use of the smart system call is the ability to adjust the type of system call method used, depending on the type of processor. For example, referring again to the example of the Pentium® III microprocessor, the “sysenter” op code is provided as part of the Pentium® III instruction set to allow for hardware-assisted protection mode switching. This op code is not available on other of the so-called “x86” architecture processors. Empirical testing has revealed that at least under certain conditions, the protection mode switch provided by the “sysenter” op code is faster than the protection mode switch provided by exception-based system calls:
TABLE 2 Average cycle time No protection switch needed: “sysenter” instruction 6.833 microseconds. exception-based system call 6.833 microseconds Protection switch needed: “sysenter” instruction 9.833 microseconds. exception-based system call 25.333 microseconds
By specifying the processor type at compile time, an application can use a code stub that achieves the fastest performance available.
A second exemplary embodiment according to the present invention will now be described. A code stub used in this second embodiment is shown below:
TABLE 3 Source Code Machine Code lte: movl % cs, % eax 0×8C, 0×C8 andl $0×3, % eax 0×83, 0×E0, 0×03 movl $lte, % eax 0×B8, 0×00, 0×00, 0×00, 0×00 jnz lteUser 0×75, 0×03 jmp *20(% eax) 0×FF, 0×60, 0×14 lteUser: mov1 % esp, % ecx 0×89, 0×E1 sysenter 0×0F, 0×34 nop 0×90
As in the first exemplary embodiment, the last 2 bits of the code segment register indicate the current protection mode of the executing task (for example, 0 for privileged mode, 3 for unprivileged mode). According to the above code stub, if the current mode is not unprivileged (i.e., the last two bits of the code segment register are non-zero), a direct jump is made to the entry address of the desired function (provided in register “%eax”). If the current mode is unprivileged (i.e., the last two bits of the code segment register are zero), a system call is made using the “sysenter” op code.
Another advantage realized from the use of the smart system call is the ability to dynamically adjust the type of system call method used. As discussed above, certain processors, such as the Pentium® III, provide special instructions that provide hardware assisted protection mode switching. By testing the processor ID register provided in the Pentium® III processor during run time (e.g., by using the “cpuid” instruction provided by the processor), the processor type may be determined, thus determining whether the “sysenter” op code is available for use.
While the above example describes dynamically switching system call methods based on processor type, dynamic switching could also be implemented on a per task or per system call basis, simply by manipulating the contents of the register/memory location used to store the processor type indicator. Such an implementation might be useful for debugging purposes—e.g., requiring an exception-based system call during debugging (which produces additional debugging information), but switching to the hardware-assisted system call during normal execution.
In a fourth embodiment according to the present invention, a facility is provided to allow substitution of code stubs based on processor type or operating system configuration. As illustrated in the embodiments above, code stubs for various system call methods may be provided, each providing an amount of flexibility in permitting the most appropriate system call method to be executed. Additionally, where the machine code generated by the code stubs provided is maintained at identical sizes across each code stub type, binary compatibility may be achieved, and thus the need to recompile/relink software when code stubs are changed may by avoided.
For example, as shown above the code stub for the interrupt-based system call may be implemented in twenty bytes of machine code (see Table 1). Likewise the code stub for the hardware-assisted system call may be implemented in twenty bytes of machine code (see Table 3). An exemplary code stub for a purely exception-based system call is shown in Table 4, below, which also be implemented in twenty bytes of machine code:
TABLE 4 Source Code Machine Code lte: movl $lte, % eax 0×B8, 0×00, 0×00, 0×00, 0×00 movl 20(% eax), % edx 0×8B, 0×50, 0×14 jmp *% edx 0×FF, 0×E2 nop 0×90 nop 0×90 nop 0×90 nop 0×90 nop 0×90 nop 0×90 nop 0×90 nop 0×90 nop 0×90 nop 0×90
Binary compatibility allows for each of these code stubs to be interchanged in any object code generated include the code stubs (with appropriate address insertions to match the desired function memory address). Moreover, should other types of system call facilities become available, or should the system call method supported by the operating system change in subsequent versions, additional code stubs may be generated and substituted, without the need to perform recompilation.
As can be seen from the exemplary embodiment, applications that reside in unprivileged address space can run in both unprivileged mode and privileged mode “on the fly” by adjusting the contents of the protection switching variable. Applications can be statically compiled and linked without the need to later re-compile and link the application due to a change in protection mode. Thus, the application may be run in unprivileged mode for debugging purposes, and then switched to privileged mode to achieve faster execution once reliability has been proven. Furthermore, the smart system call may be used to switch the system call method used, thus allowing the most effective system call to be used that is available in the computing system architecture.
As an additional implementation, the smart system call can be used in conjunction with an “inter-processor interrupt” (ISI) based system call for the multi processor system. By using this approach, exclusive access to shared kernel data in the multi processor system can be insured.
In the preceding specification, the invention has been described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made thereunto without departing from the broader spirit and scope of the invention as set forth in the claims that follow. The specification and drawings are accordingly to be regarded in an illustrative rather than restrictive sense.
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US4835677||Jan 21, 1987||May 30, 1989||Fujitsu Limited||System for directly and indirectly accessing control registers by different operating systems based upon value of operating system indication bit|
|US5848435||Oct 23, 1995||Dec 8, 1998||Emc Corporation||Address protection circuit and method for preventing access to unauthorized address rangers|
|US6175916 *||May 6, 1997||Jan 16, 2001||Microsoft Corporation||Common-thread inter-process function calls invoked by jumps to invalid addresses|
|US6308255 *||May 26, 1998||Oct 23, 2001||Advanced Micro Devices, Inc.||Symmetrical multiprocessing bus and chipset used for coprocessor support allowing non-native code to run in a system|
|US6529985 *||Feb 4, 2000||Mar 4, 2003||Ensim Corporation||Selective interception of system calls|
|US6542919 *||Mar 22, 1996||Apr 1, 2003||Koninklijke Philips Electronics N.V.||Operating system for use with protection domains in a single address space|
|US6658571 *||Feb 9, 1999||Dec 2, 2003||Secure Computing Corporation||Security framework for dynamically wrapping software applications executing in a computing system|
|US6735703 *||May 8, 2000||May 11, 2004||Networks Associates Technology, Inc.||Multi-platform sequence-based anomaly detection wrapper|
|US20050251864 *||Oct 29, 2003||Nov 10, 2005||Kelley Brian H||System for invoking a privileged function in a device|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7788487 *||Nov 26, 2004||Aug 31, 2010||Panasonic Corporation||Data processing apparatus|
|US7904879 *||Mar 8, 2011||Intel Corporation||Reorganized storing of applications to improve execution|
|US7996659 *||Aug 9, 2011||Atmel Corporation||Microprocessor instruction that allows system routine calls and returns from all contexts|
|US8645663 *||Sep 12, 2011||Feb 4, 2014||Mellanox Technologies Ltd.||Network interface controller with flexible memory handling|
|US8745276||Sep 27, 2012||Jun 3, 2014||Mellanox Technologies Ltd.||Use of free pages in handling of page faults|
|US8761189||Jun 28, 2012||Jun 24, 2014||Mellanox Technologies Ltd.||Responding to dynamically-connected transport requests|
|US8914458||Sep 27, 2012||Dec 16, 2014||Mellanox Technologies Ltd.||Look-ahead handling of page faults in I/O operations|
|US9256545||May 15, 2012||Feb 9, 2016||Mellanox Technologies Ltd.||Shared memory access using independent memory maps|
|US9298642||Nov 1, 2012||Mar 29, 2016||Mellanox Technologies Ltd.||Sharing address translation between CPU and peripheral devices|
|US20070006200 *||Jun 6, 2005||Jan 4, 2007||Renno Erik K||Microprocessor instruction that allows system routine calls and returns from all contexts|
|US20070113079 *||Nov 26, 2004||May 17, 2007||Takayuki Ito||Data processing apparatus|
|US20070288917 *||Mar 20, 2007||Dec 13, 2007||Sowa Kurt E||Reorganized Storing of Applications to Improve Execution|
|US20130067193 *||Sep 12, 2011||Mar 14, 2013||Mellanox Technologies Ltd.||Network interface controller with flexible memory handling|
|US20130346718 *||Jun 23, 2012||Dec 26, 2013||Microsoft Corporation||Storage Device Access Using Unprivileged Software Code|
|US20150074808 *||Aug 5, 2014||Mar 12, 2015||Triumfant, Inc.||Rootkit Detection in a Computer Network|
|U.S. Classification||718/104, 712/E09.075, 712/E09.035, 713/164, 711/163, 710/260|
|International Classification||G06F9/46, G06F9/318, G06F9/32, H04L9/00, G06F12/00, G06F21/00, G06F13/24|
|Cooperative Classification||G06F9/30181, G06F9/54, G06F21/52, G06F2221/2105, G06F9/322|
|European Classification||G06F9/54, G06F9/30X, G06F21/52, G06F9/32B|
|Dec 26, 2001||AS||Assignment|
Owner name: WIND RIVER SYSTEMS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:NUNOE, HDEI;REEL/FRAME:012394/0612
Effective date: 20010918
|Aug 20, 2012||REMI||Maintenance fee reminder mailed|
|Oct 19, 2012||FPAY||Fee payment|
Year of fee payment: 4
|Oct 19, 2012||SULP||Surcharge for late payment|